saml: e2e verification against a real Slack workspace

End-to-end validation of the SAML IdP against a test Slack workspace.

Surfaced by the saml-idp plan's closeout (PR #49). The plan's unit tests cover:
- metadata XML structure
- IdP-initiated POST form structure + signed assertion contents
- SP-initiated AuthnRequest handling + resume cookie flow

But these don't exercise the real Slack SP behaviour. The validation needs:

1. Connect a test Slack workspace (or codeforphilly.slack.com staging) to our IdP using the generated metadata
2. IdP-initiated: hit `/api/saml/slack/launch?channel=phlask` while signed in — verify Slack signs the user in and lands them in #phlask
3. SP-initiated: sign into Slack via "Sign in with SSO" — verify the AuthnRequest round-trip works end-to-end
4. Anonymous SP-initiated: same as (3) but starting from a signed-out browser — verify the resume cookie survives the /login redirect

Requires:
- Test Slack workspace (or staging admin access on codeforphilly.slack.com)
- Deploy to a publicly-reachable URL so Slack can POST to /api/saml/slack/sso

Out of band of the v1 cutover release.

まず saml-idp プランの完了処理と既存のユニットテストカバレッジを確認し、その後、テスト用の Slack ワークスペースとパブリックに到達可能なデプロイメントを用意します。/api/saml/slack/launch?channel=phlask、Slack の「Sign in with SSO」フロー、およびログアウト状態で /api/saml/slack/sso を経由する resume-cookie フローを実行します。3 つすべての実際の Slack シナリオが正常に完了すれば完了です。

索引モデルが issue の本文から書いたものです。